[stable33] feat(federation): Add accept/decline mechanism for federated calendars

apps/dav/appinfo/routes.php

@@ -15,6 +15,9 @@
 	],
 	'ocs' => [
 		['name' => 'direct#getUrl', 'url' => '/api/v1/direct', 'verb' => 'POST'],
+		['name' => 'federated_calendar#getPending', 'url' => '/api/v1/federated_calendars/pending', 'verb' => 'GET'],
+		['name' => 'federated_calendar#accept', 'url' => '/api/v1/federated_calendars/pending/{id}', 'verb' => 'POST'],
+		['name' => 'federated_calendar#decline', 'url' => '/api/v1/federated_calendars/pending/{id}', 'verb' => 'DELETE'],
 		['name' => 'upcoming_events#getEvents', 'url' => '/api/v1/events/upcoming', 'verb' => 'GET'],
 		['name' => 'out_of_office#getCurrentOutOfOfficeData', 'url' => '/api/v1/outOfOffice/{userId}/now', 'verb' => 'GET'],
 		['name' => 'out_of_office#getOutOfOffice', 'url' => '/api/v1/outOfOffice/{userId}', 'verb' => 'GET'],

apps/dav/composer/composer/autoload_classmap.php

@@ -76,6 +76,8 @@
     'OCA\\DAV\\CalDAV\\Federation\\FederatedCalendarEntity' => $baseDir . '/../lib/CalDAV/Federation/FederatedCalendarEntity.php',
     'OCA\\DAV\\CalDAV\\Federation\\FederatedCalendarFactory' => $baseDir . '/../lib/CalDAV/Federation/FederatedCalendarFactory.php',
     'OCA\\DAV\\CalDAV\\Federation\\FederatedCalendarImpl' => $baseDir . '/../lib/CalDAV/Federation/FederatedCalendarImpl.php',
+    'OCA\\DAV\\CalDAV\\Federation\\FederatedCalendarInvitationService' => $baseDir . '/../lib/CalDAV/Federation/FederatedCalendarInvitationService.php',
+    'OCA\\DAV\\CalDAV\\Federation\\FederatedCalendarInviteNotifier' => $baseDir . '/../lib/CalDAV/Federation/FederatedCalendarInviteNotifier.php',
     'OCA\\DAV\\CalDAV\\Federation\\FederatedCalendarMapper' => $baseDir . '/../lib/CalDAV/Federation/FederatedCalendarMapper.php',
     'OCA\\DAV\\CalDAV\\Federation\\FederatedCalendarObject' => $baseDir . '/../lib/CalDAV/Federation/FederatedCalendarObject.php',
     'OCA\\DAV\\CalDAV\\Federation\\FederatedCalendarSyncService' => $baseDir . '/../lib/CalDAV/Federation/FederatedCalendarSyncService.php',
@@ -262,6 +264,7 @@
     'OCA\\DAV\\Controller\\BirthdayCalendarController' => $baseDir . '/../lib/Controller/BirthdayCalendarController.php',
     'OCA\\DAV\\Controller\\DirectController' => $baseDir . '/../lib/Controller/DirectController.php',
     'OCA\\DAV\\Controller\\ExampleContentController' => $baseDir . '/../lib/Controller/ExampleContentController.php',
+    'OCA\\DAV\\Controller\\FederatedCalendarController' => $baseDir . '/../lib/Controller/FederatedCalendarController.php',
     'OCA\\DAV\\Controller\\InvitationResponseController' => $baseDir . '/../lib/Controller/InvitationResponseController.php',
     'OCA\\DAV\\Controller\\OutOfOfficeController' => $baseDir . '/../lib/Controller/OutOfOfficeController.php',
     'OCA\\DAV\\Controller\\UpcomingEventsController' => $baseDir . '/../lib/Controller/UpcomingEventsController.php',
@@ -393,6 +396,7 @@
     'OCA\\DAV\\Migration\\Version1034Date20250605132605' => $baseDir . '/../lib/Migration/Version1034Date20250605132605.php',
     'OCA\\DAV\\Migration\\Version1034Date20250813093701' => $baseDir . '/../lib/Migration/Version1034Date20250813093701.php',
     'OCA\\DAV\\Migration\\Version1036Date20251202000000' => $baseDir . '/../lib/Migration/Version1036Date20251202000000.php',
+    'OCA\\DAV\\Migration\\Version1040Date20260805000000' => $baseDir . '/../lib/Migration/Version1040Date20260805000000.php',
     'OCA\\DAV\\Model\\ExampleEvent' => $baseDir . '/../lib/Model/ExampleEvent.php',
     'OCA\\DAV\\Paginate\\LimitedCopyIterator' => $baseDir . '/../lib/Paginate/LimitedCopyIterator.php',
     'OCA\\DAV\\Paginate\\PaginateCache' => $baseDir . '/../lib/Paginate/PaginateCache.php',

apps/dav/composer/composer/autoload_static.php

@@ -7,14 +7,14 @@
 class ComposerStaticInitDAV
 {
     public static $prefixLengthsPsr4 = array (
-        'O' => 
+        'O' =>
         array (
             'OCA\\DAV\\' => 8,
         ),
     );
 
     public static $prefixDirsPsr4 = array (
-        'OCA\\DAV\\' => 
+        'OCA\\DAV\\' =>
         array (
             0 => __DIR__ . '/..' . '/../lib',
         ),
@@ -91,6 +91,8 @@ class ComposerStaticInitDAV
         'OCA\\DAV\\CalDAV\\Federation\\FederatedCalendarEntity' => __DIR__ . '/..' . '/../lib/CalDAV/Federation/FederatedCalendarEntity.php',
         'OCA\\DAV\\CalDAV\\Federation\\FederatedCalendarFactory' => __DIR__ . '/..' . '/../lib/CalDAV/Federation/FederatedCalendarFactory.php',
         'OCA\\DAV\\CalDAV\\Federation\\FederatedCalendarImpl' => __DIR__ . '/..' . '/../lib/CalDAV/Federation/FederatedCalendarImpl.php',
+        'OCA\\DAV\\CalDAV\\Federation\\FederatedCalendarInvitationService' => __DIR__ . '/..' . '/../lib/CalDAV/Federation/FederatedCalendarInvitationService.php',
+        'OCA\\DAV\\CalDAV\\Federation\\FederatedCalendarInviteNotifier' => __DIR__ . '/..' . '/../lib/CalDAV/Federation/FederatedCalendarInviteNotifier.php',
         'OCA\\DAV\\CalDAV\\Federation\\FederatedCalendarMapper' => __DIR__ . '/..' . '/../lib/CalDAV/Federation/FederatedCalendarMapper.php',
         'OCA\\DAV\\CalDAV\\Federation\\FederatedCalendarObject' => __DIR__ . '/..' . '/../lib/CalDAV/Federation/FederatedCalendarObject.php',
         'OCA\\DAV\\CalDAV\\Federation\\FederatedCalendarSyncService' => __DIR__ . '/..' . '/../lib/CalDAV/Federation/FederatedCalendarSyncService.php',
@@ -277,6 +279,7 @@ class ComposerStaticInitDAV
         'OCA\\DAV\\Controller\\BirthdayCalendarController' => __DIR__ . '/..' . '/../lib/Controller/BirthdayCalendarController.php',
         'OCA\\DAV\\Controller\\DirectController' => __DIR__ . '/..' . '/../lib/Controller/DirectController.php',
         'OCA\\DAV\\Controller\\ExampleContentController' => __DIR__ . '/..' . '/../lib/Controller/ExampleContentController.php',
+        'OCA\\DAV\\Controller\\FederatedCalendarController' => __DIR__ . '/..' . '/../lib/Controller/FederatedCalendarController.php',
         'OCA\\DAV\\Controller\\InvitationResponseController' => __DIR__ . '/..' . '/../lib/Controller/InvitationResponseController.php',
         'OCA\\DAV\\Controller\\OutOfOfficeController' => __DIR__ . '/..' . '/../lib/Controller/OutOfOfficeController.php',
         'OCA\\DAV\\Controller\\UpcomingEventsController' => __DIR__ . '/..' . '/../lib/Controller/UpcomingEventsController.php',
@@ -408,6 +411,7 @@ class ComposerStaticInitDAV
         'OCA\\DAV\\Migration\\Version1034Date20250605132605' => __DIR__ . '/..' . '/../lib/Migration/Version1034Date20250605132605.php',
         'OCA\\DAV\\Migration\\Version1034Date20250813093701' => __DIR__ . '/..' . '/../lib/Migration/Version1034Date20250813093701.php',
         'OCA\\DAV\\Migration\\Version1036Date20251202000000' => __DIR__ . '/..' . '/../lib/Migration/Version1036Date20251202000000.php',
+        'OCA\\DAV\\Migration\\Version1040Date20260805000000' => __DIR__ . '/..' . '/../lib/Migration/Version1040Date20260805000000.php',
         'OCA\\DAV\\Model\\ExampleEvent' => __DIR__ . '/..' . '/../lib/Model/ExampleEvent.php',
         'OCA\\DAV\\Paginate\\LimitedCopyIterator' => __DIR__ . '/..' . '/../lib/Paginate/LimitedCopyIterator.php',
         'OCA\\DAV\\Paginate\\PaginateCache' => __DIR__ . '/..' . '/../lib/Paginate/PaginateCache.php',

apps/dav/lib/AppInfo/Application.php

@@ -14,6 +14,7 @@
 use OCA\DAV\CalDAV\CalendarManager;
 use OCA\DAV\CalDAV\CalendarProvider;
 use OCA\DAV\CalDAV\Federation\CalendarFederationProvider;
+use OCA\DAV\CalDAV\Federation\FederatedCalendarInviteNotifier;
 use OCA\DAV\CalDAV\Reminder\NotificationProvider\AudioProvider;
 use OCA\DAV\CalDAV\Reminder\NotificationProvider\EmailProvider;
 use OCA\DAV\CalDAV\Reminder\NotificationProvider\PushProvider;
@@ -216,6 +217,7 @@ public function register(IRegistrationContext $context): void {
 
 		$context->registerNotifierService(NotifierCalDAV::class);
 		$context->registerNotifierService(NotifierCardDAV::class);
+		$context->registerNotifierService(FederatedCalendarInviteNotifier::class);
 
 		$context->registerCalendarProvider(CalendarProvider::class);
 		$context->registerCalendarProvider(CachedSubscriptionProvider::class);

apps/dav/lib/BackgroundJob/FederatedCalendarSyncJob.php

@@ -10,6 +10,7 @@
 namespace OCA\DAV\BackgroundJob;
 
 use OCA\DAV\CalDAV\Federation\CalendarFederationConfig;
+use OCA\DAV\CalDAV\Federation\FederatedCalendarEntity;
 use OCA\DAV\CalDAV\Federation\FederatedCalendarMapper;
 use OCA\DAV\CalDAV\Federation\FederatedCalendarSyncService;
 use OCP\AppFramework\Db\DoesNotExistException;
@@ -50,6 +51,11 @@ protected function run($argument): void {
 			return;
 		}
 
+		// Never fetch data for invitations the sharee did not accept (yet)
+		if ($calendar->getState() !== FederatedCalendarEntity::STATE_ACCEPTED) {
+			return;
+		}
+
 		try {
 			$this->syncService->syncOne($calendar);
 		} catch (ClientExceptionInterface $e) {

apps/dav/lib/CalDAV/CalDavBackend.php

@@ -4053,7 +4053,10 @@ public function unshare(IShareable $shareable, string $principal): void {
 	 * @return array<string, mixed>[]
 	 */
 	public function getFederatedCalendarsForUser(string $principalUri): array {
-		$federatedCalendars = $this->federatedCalendarMapper->findByPrincipalUri($principalUri);
+		$federatedCalendars = $this->federatedCalendarMapper->findByPrincipalUri(
+			$principalUri,
+			FederatedCalendarEntity::STATE_ACCEPTED,
+		);
 		return array_map(
 			static fn (FederatedCalendarEntity $entity) => $entity->toCalendarInfo(),
 			$federatedCalendars,
@@ -4062,6 +4065,10 @@ public function getFederatedCalendarsForUser(string $principalUri): array {
 
 	public function getFederatedCalendarByUri(string $principalUri, string $uri): ?array {
 		$federatedCalendar = $this->federatedCalendarMapper->findByUri($principalUri, $uri);
-		return $federatedCalendar?->toCalendarInfo();
+		if ($federatedCalendar === null
+			|| $federatedCalendar->getState() !== FederatedCalendarEntity::STATE_ACCEPTED) {
+			return null;
+		}
+		return $federatedCalendar->toCalendarInfo();
 	}
 }

apps/dav/lib/CalDAV/Federation/CalendarFederationConfig.php

@@ -41,4 +41,11 @@ public function isIncomingServer2serverShareEnabled(): bool {
 		}
 		return $this->appConfig->getValueBool('files_sharing', 'incoming_server2server_share_enabled', true);
 	}
+
+	/**
+	 * Check if incoming shares from trusted servers are accepted automatically
+	 */
+	public function isTrustedShareAutoAcceptEnabled(): bool {
+		return $this->appConfig->getValueBool('files_sharing', 'federatedTrustedShareAutoAccept', true);
+	}
 }

apps/dav/lib/CalDAV/Federation/CalendarFederationProvider.php

@@ -36,6 +36,7 @@ public function __construct(
 		private readonly CalendarFederationConfig $calendarFederationConfig,
 		private readonly IJobList $jobList,
 		private readonly ICloudIdManager $cloudIdManager,
+		private readonly FederatedCalendarInvitationService $invitationService,
 	) {
 	}
 
@@ -131,8 +132,8 @@ public function shareReceived(ICloudFederationShare $share): string {
 
 		$sharedWithPrincipal = 'principals/users/' . $share->getShareWith();
 
-		// Delete existing incoming federated share first
 		$calendar = $this->federatedCalendarMapper->findByUri($sharedWithPrincipal, $calendarUri);
+		$isNew = $calendar === null;
 
 		if ($calendar === null) {
 			$calendar = new FederatedCalendarEntity();
@@ -146,17 +147,34 @@ public function shareReceived(ICloudFederationShare $share): string {
 			$calendar->setSharedByDisplayName($share->getSharedByDisplayName());
 			$calendar->setPermissions($permissions);
 			$calendar->setComponents($components);
+			$calendar->setState(FederatedCalendarEntity::STATE_PENDING);
 			$calendar = $this->federatedCalendarMapper->insert($calendar);
 		} else {
 			$calendar->setToken($share->getShareSecret());
 			$calendar->setPermissions($permissions);
 			$calendar->setComponents($components);
+			if ($calendar->getState() === FederatedCalendarEntity::STATE_PENDING) {
+				// The open invitation shows the sharer's metadata, keep it
+				// fresh. Accepted calendars are not touched as the sharee owns
+				// the display name and color from that point on.
+				$calendar->setDisplayName($displayName);
+				$calendar->setColor($color);
+				$calendar->setSharedByDisplayName($share->getSharedByDisplayName());
+			}
 			$this->federatedCalendarMapper->update($calendar);
 		}
 
-		$this->jobList->add(FederatedCalendarSyncJob::class, [
-			FederatedCalendarSyncJob::ARGUMENT_ID => $calendar->getId(),
-		]);
+		if ($calendar->getState() === FederatedCalendarEntity::STATE_ACCEPTED) {
+			// Re-share of an already accepted calendar: just refresh the data
+			$this->jobList->add(FederatedCalendarSyncJob::class, [
+				FederatedCalendarSyncJob::ARGUMENT_ID => $calendar->getId(),
+			]);
+		} elseif ($this->invitationService->shouldAutoAccept($share->getOwner(), $calendar->getRemoteUrl())) {
+			$this->invitationService->accept($calendar);
+		} elseif ($isNew) {
+			// A re-shared pending calendar keeps its original invitation
+			$this->invitationService->notifyAboutNewShare($calendar);
+		}
 
 		return (string)$calendar->getId();
 	}
@@ -212,6 +230,7 @@ private function handleSyncCalendarNotification(array $notification): array {
 			$calendarUrl,
 			'principals/users/' . $shareWith->getUser(),
 			$sharedSecret,
+			FederatedCalendarEntity::STATE_ACCEPTED,
 		);
 		if (empty($calendars)) {
 			throw new ShareNotFound('Calendar is not shared with the sharee');

apps/dav/lib/CalDAV/Federation/FederatedCalendarEntity.php

@@ -39,8 +39,13 @@
  * @method void setSharedByDisplayName(string $sharedByDisplayName)
  * @method string getComponents()
  * @method void setComponents(string $components)
+ * @method int getState()
+ * @method void setState(int $state)
  */
 class FederatedCalendarEntity extends Entity {
+	public const STATE_PENDING = 0;
+	public const STATE_ACCEPTED = 1;
+
 	protected string $principaluri = '';
 	protected string $uri = '';
 	protected string $displayName = '';
@@ -53,6 +58,7 @@ class FederatedCalendarEntity extends Entity {
 	protected string $sharedBy = '';
 	protected string $sharedByDisplayName = '';
 	protected string $components = '';
+	protected int $state = self::STATE_PENDING;
 
 	public function __construct() {
 		$this->addType('principaluri', Types::STRING);
@@ -67,6 +73,7 @@ public function __construct() {
 		$this->addType('sharedBy', Types::STRING);
 		$this->addType('sharedByDisplayName', Types::STRING);
 		$this->addType('components', Types::STRING);
+		$this->addType('state', Types::INTEGER);
 	}
 
 	public function getSyncTokenForSabre(): string {

apps/dav/lib/CalDAV/Federation/FederatedCalendarInvitationService.php

@@ -0,0 +1,152 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\DAV\CalDAV\Federation;
+
+use OCA\DAV\AppInfo\Application;
+use OCA\DAV\BackgroundJob\FederatedCalendarSyncJob;
+use OCA\Federation\TrustedServers;
+use OCP\App\IAppManager;
+use OCP\BackgroundJob\IJobList;
+use OCP\Federation\ICloudIdManager;
+use OCP\IURLGenerator;
+use OCP\Notification\IManager as INotificationManager;
+use OCP\Server;
+use Psr\Log\LoggerInterface;
+
+class FederatedCalendarInvitationService {
+	public const NOTIFICATION_OBJECT_TYPE = 'federated_calendar_share';
+	public const NOTIFICATION_SUBJECT_NEW_SHARE = 'federated_calendar_share';
+
+	private const PRINCIPAL_PREFIX = 'principals/users/';
+
+	public function __construct(
+		private readonly FederatedCalendarMapper $mapper,
+		private readonly IJobList $jobList,
+		private readonly INotificationManager $notificationManager,
+		private readonly IURLGenerator $url,
+		private readonly ICloudIdManager $cloudIdManager,
+		private readonly CalendarFederationConfig $config,
+		private readonly IAppManager $appManager,
+		private readonly LoggerInterface $logger,
+	) {
+	}
+
+	public function accept(FederatedCalendarEntity $calendar): void {
+		$calendar->setState(FederatedCalendarEntity::STATE_ACCEPTED);
+		$this->mapper->update($calendar);
+
+		$this->jobList->add(FederatedCalendarSyncJob::class, [
+			FederatedCalendarSyncJob::ARGUMENT_ID => $calendar->getId(),
+		]);
+
+		$this->dismissNotification($calendar);
+	}
+
+	public function decline(FederatedCalendarEntity $calendar): void {
+		// Dismiss first: a leftover bell notification would offer actions for
+		// a share that no longer exists
+		$this->dismissNotification($calendar);
+		$this->mapper->deleteById($calendar->getId());
+	}
+
+	public function notifyAboutNewShare(FederatedCalendarEntity $calendar): void {
+		$notification = $this->notificationManager->createNotification();
+		$notification->setApp(Application::APP_ID)
+			->setUser($this->getUserId($calendar))
+			->setDateTime(new \DateTime())
+			->setObject(self::NOTIFICATION_OBJECT_TYPE, (string)$calendar->getId())
+			->setSubject(self::NOTIFICATION_SUBJECT_NEW_SHARE, [
+				'sharedBy' => $calendar->getSharedBy(),
+				'sharedByDisplayName' => $calendar->getSharedByDisplayName(),
+				'calendarName' => $calendar->getDisplayName(),
+			]);
+
+		$endpointUrl = $this->url->linkToOCSRouteAbsolute('dav.federated_calendar.accept', [
+			'id' => $calendar->getId(),
+		]);
+
+		$declineAction = $notification->createAction();
+		$declineAction->setLabel('decline')
+			->setLink($endpointUrl, 'DELETE');
+		$notification->addAction($declineAction);
+
+		$acceptAction = $notification->createAction();
+		$acceptAction->setLabel('accept')
+			->setLink($endpointUrl, 'POST');
+		$notification->addAction($acceptAction);
+
+		$this->notificationManager->notify($notification);
+	}
+
+	public function dismissNotification(FederatedCalendarEntity $calendar): void {
+		$notification = $this->notificationManager->createNotification();
+		$notification->setApp(Application::APP_ID)
+			->setUser($this->getUserId($calendar))
+			->setObject(self::NOTIFICATION_OBJECT_TYPE, (string)$calendar->getId());
+		$this->notificationManager->markProcessed($notification);
+	}
+
+	public function shouldAutoAccept(?string $ownerCloudId, string $remoteUrl): bool {
+		if ($ownerCloudId === null || $ownerCloudId === '') {
+			return false;
+		}
+
+		if (!$this->config->isTrustedShareAutoAcceptEnabled()) {
+			return false;
+		}
+
+		$trustedServers = $this->getTrustedServers();
+		if ($trustedServers === null) {
+			return false;
+		}
+
+		try {
+			$remote = $this->cloudIdManager->resolveCloudId($ownerCloudId)->getRemote();
+		} catch (\InvalidArgumentException) {
+			return false;
+		}
+
+		if (!$trustedServers->isTrustedServer($remote)) {
+			return false;
+		}
+
+		return $this->isSameHost($remote, $remoteUrl);
+	}
+
+	private function isSameHost(string $remote, string $remoteUrl): bool {
+		$remoteParts = parse_url(str_contains($remote, '://') ? $remote : '//' . $remote);
+		$urlParts = parse_url($remoteUrl);
+		if (!is_array($remoteParts) || !is_array($urlParts)
+			|| !isset($remoteParts['host'], $urlParts['host'])) {
+			return false;
+		}
+
+		return strcasecmp($remoteParts['host'], $urlParts['host']) === 0
+			&& ($remoteParts['port'] ?? null) === ($urlParts['port'] ?? null);
+	}
+
+	protected function getTrustedServers(): ?TrustedServers {
+		if (!$this->appManager->isEnabledForAnyone('federation')
+			|| !class_exists(TrustedServers::class)) {
+			return null;
+		}
+
+		try {
+			return Server::get(TrustedServers::class);
+		} catch (\Throwable $e) {
+			$this->logger->debug('Failed to create TrustedServers', ['exception' => $e]);
+			return null;
+		}
+	}
+
+	private function getUserId(FederatedCalendarEntity $calendar): string {
+		return substr($calendar->getPrincipaluri(), strlen(self::PRINCIPAL_PREFIX));
+	}
+}